Match each cybersecurity scenario or document with its corresponding role or classification in incident management: 1. Quarantined suspicious email 2. Unplanned system outage 3. Unauthorized data exfiltration by an insider 4. Formal cybersecurity policy A. Security event evaluated by an analyst B. Adverse event impacting operations C. Security incident requiring a full response D. Foundational document establishing response authority

### The pairs | Item | Matches | Why | |---|---|---| | Quarantined suspicious email | Event assessed by an analyst | The material says an analyst assesses the email and decides whether to release or eradicate it. | | System outage | Adverse event | The material classifies system outages as adverse events, whether malicious or accidental. | | Insider threat involving unauthorized data removal | Situation triggering full incident response | Unauthorized removal of data by an insider is given as an example that triggers full response. | | Formal cybersecurity policy | Foundation that provides response authority | Policy gives the organization a mandate to take response and recovery actions. | ### Terms - **Eradicate**: Remove the harmful item or cause from the environment. - **Mandate**: Formal authority or direction to act. ### Remember Classify the situation by the material’s examples, then follow the established response procedure.